fix(server): accept invite condition (#9124)

packages/backend/server/src/core/permission/service.ts

@@ -323,16 +323,23 @@ export class PermissionService {
     });
 
     if (data) {
+      const toBeOwner = permission === Permission.Owner;
       if (data.accepted && data.status === WorkspaceMemberStatus.Accepted) {
         const [p] = await this.prisma.$transaction(
           [
             this.prisma.workspaceUserPermission.update({
-              where: { workspaceId_userId: { workspaceId: ws, userId: user } },
+              where: {
+                workspaceId_userId: { workspaceId: ws, userId: user },
+                // only update permission:
+                // 1. if the new permission is owner and original permission is admin
+                // 2. if the original permission is not owner
+                type: toBeOwner ? Permission.Admin : { not: Permission.Owner },
+              },
               data: { type: permission },
             }),
 
             // If the new permission is owner, we need to revoke old owner
-            permission === Permission.Owner
+            toBeOwner
               ? this.prisma.workspaceUserPermission.updateMany({
                   where: {
                     workspaceId: ws,

packages/backend/server/src/core/workspaces/resolvers/workspace.ts

@@ -15,6 +15,7 @@ import GraphQLUpload from 'graphql-upload/GraphQLUpload.mjs';
 
 import type { FileUpload } from '../../../fundamentals';
 import {
+  AlreadyInSpace,
   Cache,
   CantChangeSpaceOwner,
   DocNotFound,
@@ -528,6 +529,14 @@ export class WorkspaceResolver {
     }
 
     if (user) {
+      const status = await this.permissions.getWorkspaceMemberStatus(
+        workspaceId,
+        user.id
+      );
+      if (status === WorkspaceMemberStatus.Accepted) {
+        throw new AlreadyInSpace({ spaceId: workspaceId });
+      }
+
       // invite link
       const invite = await this.cache.get<{ inviteId: string }>(
         `workspace:inviteLink:${workspaceId}`

packages/backend/server/tests/team.e2e.ts

@@ -120,6 +120,9 @@ const init = async (app: INestApplication, memberLimit = 10) => {
         await acceptInviteById(app, ws.id, inviteId, false, member.token.token);
         return member;
       },
+      async (token: string) => {
+        await acceptInviteById(app, ws.id, inviteId, false, token);
+      },
     ] as const;
   };
 
@@ -259,7 +262,7 @@ test('should be able to leave workspace', async t => {
 test('should be able to invite by link', async t => {
   const { app, permissions, quotaManager } = t.context;
   const { createInviteLink, owner, ws } = await init(app, 4);
-  const [inviteId, invite] = await createInviteLink();
+  const [inviteId, invite, acceptInvite] = await createInviteLink();
 
   {
     // check invite link
@@ -311,5 +314,14 @@ test('should be able to invite by link', async t => {
       WorkspaceMemberStatus.UnderReview,
       'should not change status'
     );
+
+    {
+      const message = `You have already joined in Space ${ws.id}.`;
+      await t.throwsAsync(
+        acceptInvite(owner.token.token),
+        { message },
+        'should throw error if member already in workspace'
+      );
+    }
   }
 });